From e6d80ad69bfcb48ef7c8db34adfa2db5fd4d918f Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 8 Oct 2026 09:41:50 +0200 Subject: [PATCH] send-post: read the bot token from the KV v2 path directly bao kv get preflights sys/internal/ui/mounts, which returned 403. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012 --- scripts/send-post.sh | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/scripts/send-post.sh b/scripts/send-post.sh index 9d965da..ee08631 100755 --- a/scripts/send-post.sh +++ b/scripts/send-post.sh @@ -30,9 +30,12 @@ TELEGRAM_CHANNEL_ID=$(go run ./cmd/provision adapter-config --spec "$spec" --cha tmp=$(mktemp -d) go build -o "$tmp/adapter" ./cmd/adapter -token=$(bao kv get -mount=platform -field=token \ - workloads/infotech/fluid-telegram/hall-of-helix/bot-token) \ - || { rm -rf "$tmp"; echo "could not read the bot token from OpenBao (logged in?)" >&2; exit 2; } +# Read the KV v2 data path directly: `bao kv get` first queries +# sys/internal/ui/mounts, which a workload-scoped token may not be allowed to. +token=$(bao read -format=json \ + platform/data/workloads/infotech/fluid-telegram/hall-of-helix/bot-token \ + | python3 -c 'import sys, json; print(json.load(sys.stdin)["data"]["data"]["token"])') \ + || { rm -rf "$tmp"; echo "could not read the bot token from OpenBao (logged in? read on platform/data/workloads/infotech/fluid-telegram/hall-of-helix/*?)" >&2; exit 2; } TELEGRAM_BOT_TOKEN=$token TELEGRAM_CHANNEL_ID=$TELEGRAM_CHANNEL_ID \ ADAPTER_LISTEN_ADDR=127.0.0.1:$port "$tmp/adapter" &